Reported by 4 outlets

Timeline

1. original reporting

   Iran-Linked Hackers Shut Down UK Power Plant for Four Days in Cyberattack

   gbhackers.com · 51d ago · August 24th, 2026

   A cyberattack linked to Iranian threat actors forced a British power plant offline for four consecutive days in July, reportedly marking the first successful cyber incident to disrupt a UK energy-generation facility completely. This incident, first reported by The Telegraph, affected a small-scale electricity generator rather than a major power station. The UK government emphasized […] The post Iran-Linked Hackers Shut Down UK Power Plant for Four Days in Cyberattack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Iranian-Linked Hackers Disrupt UK Energy Infrastructure in Four-Day Attack

   cyberpress.org · 51d ago · August 24th, 2026

   A cyberattack attributed to Iran-linked hackers forced a small British power facility offline for four consecutive days in July, raising fresh concerns about the exposure of UK energy infrastructure to geopolitically motivated threats. The incident, first reported by The Telegraph , is believed to represent the first known case in which hackers affiliated with Iran successfully caused a UK power-generation site to shut down completely. While the disruption did not endanger the national electricity grid, officials and security analysts view it as a significant demonstration of capability against critical infrastructure. The Department for Energy Security and Net Zero (DESNZ) confirmed that the event affected a “small-scale energy generator.” A department spokesperson stressed that the UK’s wider energy system remained secure and that the incident posed no risk to national supply. Iranian-Linked Hackers Disrupt UK Energy Infrastructure “The UK has a highly resilient energy system,” the spokesperson said, adding that the government works closely with energy-sector organizations to maintain high cybersecurity standards. Government sources characterized the targeted generator as “less than a rounding error compared to grid capacity.” The facility was reportedly below the statutory threshold requiring major electricity generators to formally report significant cyber incidents. However, the attack’s strategic importance may exceed its operational impact. Security analysts believe th

3. update from securityweek.com

   Iran-Linked Hackers Shut Down UK Power Plant for Four Days

   securityweek.com · 50d ago · August 24th, 2026

   The story was broken by The Telegraph newspaper on August 22, 2026. That it took so long to become public knowledge immediately says two things. Firstly, it was not a major power plant since the effect would have been immediately noticed, and secondly, the authorities wished to keep news of the attack as low key as possible. Other newspapers (for example the BBC, the Guardian and the Financial Times) have since published their own stories, largely based on the Telegraph account. There has been virtually no information coming from the expected official sources, such as the NCSC. The BBC report comments, "While the Western cyber-security world is braced for attacks either from the state [of Iran] or hackers linked to the state as a result of its conflict with the US this year, there has been little activity so far."

   This last point is clearly wrong. Since the outbreak of the war with US / Israel, Iran affiliated cyber groups have attacked multiple targets in the US (water, critical infrastructure and military-linked assets), Israel (military, government, energy, healthcare, and more), GCC targets in UAE, Bahrain, Kuwait, Qatar, Saudi Arabia, and Europe (Cyprus, Romania and now Britain). This does not equate to 'little activity so far', so the expansion into the UK should not be downplayed. "The significance isn't the size of the facility, but that a cyberattack turned into four days of real-world operational disruption. That raises an important question: why did recovery take four days, and are smaller operators adequately prepared to contain and recover from these incidents?", asks Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress. "The loss of a single facility like this can be well managed and as reported, doesn't constitute a major risk to stability, but these are often very repeatable attacks that could be deployed at scale," posts Phil Tonkin, field CTO at Dragos, on LinkedIn. Rafael Narezzi, CEO of Centrii, points out that attackers don't worry about the size of the target - they are looking for trusted access and opportunities. This particular incident may not have had consequences for the wider grid, but the next one could be different."

   "The UK has thousands of distributed assets increasingly contributing to how our energy system operates. Individually, many may appear insignificant. Collectively, their resilience matters enormously."

   Graeme Stewart, head of public sector at Check Point, warns, "This marks a grave escalation in the Iran conflict because a hostile state-linked cyber threat has reportedly reached into UK energy infrastructure and caused a physical shutdown lasting four days. That should concern every organization responsible for keeping this country running. The far more serious point is what the attackers appear to have demonstrated: an ability to get inside UK energy infrastructure and stop it working."

   Since the start of the Iran war, Iranian hackers have targeted the critical infrastructure of the US and its allies. Other than Israel, the UK is generally considered to be a major ally of the US. Britain cannot be surprised that it is a target - indeed, the greater surprise is that this appears to be the only known successful Iranian cyberattack to date. Apart from the lack of official information (almost all knowledge is based on a single report in the Telegraph), concern should also focus on the apparent lack of resilience in the hacked power station. Four days to recover in such an important part of the CNI is simply too long.

4. update from malware.news

   Iranian Cyberattacks Against Critical Infrastructure

   malware.news · 50d ago · August 24th, 2026

   The attacks appear to have targeted operational technology (OT) devices like programmable logic controllers (PLCs). A warning from FBI specifically mentioned Rockwell Automation and Allen-Bradley PLCs – particularly the MicroLogix 1100 and 1400 series – although systems using PLCs from other brands were also advised to be cautious. [1] Assessment Based on available information, it appears that these attacks have been mostly unsophisticated and opportunistic attacks targeting relatively small plants with minimum security, likely having OT devices exposed to the internet without proper protection. Given the limited impact of these attacks, it appears they were mostly aimed at creating psychological impact rather than real damage. Truesec has previously assessed that the risk of destructive cyberattacks from Iran against Europe as low, as long as European countries don’t get directly involved in the conflict between USA and Iran. This assessment still stands. Both countries are honoring their bilateral defense agreements with several Gulf-states and assist them in shooting down incoming Iranian missiles, which is likely the reason Ir

5. update from cyberpress.org

   Cyberattack Disrupts 15 MW UK Power Plant for Four Days as OT Attack Vector Remains Unknown

   cyberpress.org · 46d ago · August 28th, 2026

   The event did not cause consumer power outages, and the wider UK electricity network continued to operate normally. Energy Minister Michael Shanks said the generator was very small when compared with major UK power stations. Financial Times reporting identified the affected site as an approximately 15 MW gas-fired peaking plant. Such facilities provide additional generation during high-demand periods, but the loss of one small site did not create a national electricity-supply risk. Still, the four-day outage is significant. A small plant may not threaten grid stability, but it relies on digital systems to monitor, start, stop and manage physical equipment. A cyber incident affecting engineering workstations, remote-access systems, industrial control networks or supporting IT can force operators to suspend production while they investigate and validate the environment.

6. mentioned by gbhackers.com

   Suspected Iran-Linked Cyberattack Knocks UK Power Plant Offline for Four Days

   gbhackers.com · 46d ago · August 28th, 2026

7. mentioned by www.securityweek.com

   Iran-Linked Hackers Shut Down UK Power Plant for Four Days Iran-linked hackers shut down a British power plant for 4 days in July 2026. Dela

   www.securityweek.com · 10d ago · October 3rd, 2026